A regulated business received a request from one of their lead investors to assess their current level of cyber security protection.